Security Incidents Analysis: Global Patterns and Trends

1 Introduction

This analysis explores patterns and trends in global security incidents, identifying hotspots and tracking how they’ve evolved over time. By examining data on security incidents from around the world, we can better understand which regions face the greatest challenges and how these challenges have shifted in recent years.

Security incidents can range from physical attacks to cyber threats, and their distribution isn’t uniform across the globe. Understanding these patterns can help security professionals, policymakers, and researchers allocate resources effectively and develop targeted strategies to mitigate risks.

The following analysis uses data visualization techniques to uncover insights about:

• The geographic distribution of security incidents
• How incident patterns have changed over time
• Which countries represent security hotspots, both historically and recently
• The nature and impact of different incident types

1.1 Dataset Overview

Our analysis begins with a cleaned dataset of security incidents collected from various sources. Let’s examine the scope of our data:

print(f"Dataset contains {len(df)} incidents across {df['country'].nunique()} countries")
print(f"Time period covered: {df['year'].min()} to {df['year'].max()}")

Dataset contains 4314 incidents across 95 countries
Time period covered: 1997 to 2025

This extensive dataset allows us to perform comprehensive analysis across both geographic and temporal dimensions. The data has been preprocessed to ensure consistency in country names, coordinate information, and incident classifications.

2 Global Distribution of Security Incidents

Security incidents aren’t distributed evenly across the world. Some regions experience higher concentrations due to various factors including geopolitical tensions, economic disparities, and historical conflicts. Visualizing this distribution helps us identify global patterns.

2.1 Interactive Global Incident Map

The map below displays incidents across the globe, with colors indicating the severity based on the number of people affected:

• Blue: No reported casualties
• Green: 1-5 affected individuals
• Orange: 6-20 affected individuals
• Red: More than 20 affected individuals

Clustering is used to manage dense areas where multiple incidents occurred in close proximity.

def create_incidents_map(data):
    """
    Create an interactive folium map with clustered markers for security incidents.
    
    Args:
        data: DataFrame containing incident data with latitude and longitude coordinates
        
    Returns:
        folium.Map: Interactive map with clustered markers
    """
    # Calculate center coordinates for the map
    center_lat = data['latitude'].mean()
    center_lon = data['longitude'].mean()
    
    # Create base map
    incidents_map = folium.Map(location=[center_lat, center_lon], zoom_start=2)
    
    # Add marker cluster
    marker_cluster = MarkerCluster().add_to(incidents_map)
    
    # Filter for valid coordinates
    valid_coords = data[data['latitude'].notna() & data['longitude'].notna()]
    
    # Define color function based on number of affected people
    def get_color(affected):
        if pd.isna(affected) or affected == 0:
            return palette["secondary"]  # Blue
        elif affected <= 5:
            return palette["primary"]    # Orange
        elif affected <= 20:
            return "#FF9A3C"             # Darker orange
        else:
            return palette["danger"]     # Red
    
    # Add markers for each incident
    for _, row in valid_coords.iterrows():
        popup_text = f"""
        <b>Country:</b> {row['country']}<br>
        <b>Year:</b> {row['year']}<br>
        <b>Total Affected:</b> {row['total_affected']}<br>
        <b>Attack Type:</b> {row['means_of_attack'] if 'means_of_attack' in row and pd.notna(row['means_of_attack']) else 'Unknown'}<br>
        """
        
        folium.CircleMarker(
            location=[row['latitude'], row['longitude']],
            radius=5,
            popup=folium.Popup(popup_text, max_width=300),
            fill=True,
            fill_opacity=0.7,
            color=get_color(row['total_affected']),
            fill_color=get_color(row['total_affected'])
        ).add_to(marker_cluster)
    
    return incidents_map

# Create and display the global incidents map
global_incidents_map = create_incidents_map(df)
map_filename = "images/global_security_incidents_map.html"
global_incidents_map.save(map_filename)
global_incidents_map

Make this Notebook Trusted to load map: File -> Trust Notebook

The interactive map reveals several important patterns:

• Incidents tend to cluster in certain regions, particularly in conflict zones and areas with political instability
• Urban centers often show higher concentrations of incidents
• The distribution of high-severity incidents (red markers) isn’t uniform, suggesting regional differences in the nature of security threats

You can zoom in on specific regions and click on individual markers to get more details about each incident.

3 Temporal Trends in Security Incidents

Security landscapes evolve over time. By examining how incident patterns change year by year, we can identify emerging hotspots and areas where security might be improving.

3.1 Incidents by Country Over Time

The animated choropleth map below shows how the distribution of security incidents has shifted over the years. Darker colors indicate higher numbers of incidents.

incidents_by_year_country = df.groupby(['year', 'country']).size().reset_index(name='incidents')
year_totals = incidents_by_year_country.groupby('year')['incidents'].sum().reset_index().sort_values('year')

# Create a custom orange-blue color scale using our palette colors
custom_colorscale = [
    [0, "#FFFFFF"],  # White for zero
    [0.5, palette["primary"]],  # Orange for mid values
    [1, "#B36D00"]   # Darker orange for high values
]

fig = px.choropleth(
    incidents_by_year_country,
    locations='country',
    locationmode='country names',
    color='incidents',
    animation_frame='year',
    color_continuous_scale=custom_colorscale,
    range_color=[0, incidents_by_year_country['incidents'].max()],
    height=600
)

fig.update_layout(
    title={
        'text': 'Security Incidents by Country Over Time',
        'y': 0.95,
        'x': 0.5,
        'xanchor': 'center',
        'yanchor': 'top',
        'font': {'size': 24}
    },
    coloraxis_colorbar=dict(title='Number of Incidents'),
    geo=dict(showframe=False, showcoastlines=True, projection_type='natural earth'),
    margin=dict(t=100)
)

fig.layout.updatemenus[0].buttons[0].args[1]['frame']['duration'] = 1000
fig.layout.updatemenus[0].buttons[0].args[1]['transition']['duration'] = 500

for i, year in enumerate(year_totals['year'].unique()):
    year_total = year_totals.loc[year_totals['year'] == year, 'incidents'].values[0]
    fig.frames[i].layout.annotations = [
        dict(
            x=0.5,
            y=0.87,
            xref='paper',
            yref='paper',
            text=f'Total Incidents in {year}: {year_total}',
            showarrow=False,
            font=dict(size=18)
        )
    ]

latest_year = year_totals['year'].max()
latest_total = year_totals.loc[year_totals['year'] == latest_year, 'incidents'].values[0]
fig.update_layout(annotations=[
    dict(
        x=0.5,
        y=0.87,
        xref='paper',
        yref='paper',
        text=f'Total Incidents in {latest_year}: {latest_total}',
        showarrow=False,
        font=dict(size=18)
    )
])

fig.write_html("images/interactive_incidents_over_time.html")
fig.show()

This visualization reveals several key insights:

• The global distribution of security incidents has shifted significantly over time
• Some countries that were previously security hotspots have shown improvement
• New areas of concern have emerged in recent years
• The total number of recorded incidents shows notable year-to-year variation

You can use the play button to animate the map through time, or manually select specific years using the slider.

3.2 Annual Incident Trends

To better understand the overall temporal pattern of security incidents, we can examine the yearly totals across all countries.

# Aggregate incidents by year
year_incidents = df.groupby('year').size().reset_index(name='incidents')
year_incidents['year'] = year_incidents['year'].astype(str)

# Create interactive bar chart
fig2 = px.bar(
    year_incidents,
    x='year',
    y='incidents',
    labels={'incidents': 'Number of Incidents', 'year': 'Year'},
    height=400
)

# Update bar colors to primary orange
fig2.update_traces(marker_color=palette["primary"])

# Configure layout
fig2.update_layout(
    title={
        'text': 'Security Incidents by Year',
        'y': 0.95,
        'x': 0.5,
        'xanchor': 'center',
        'yanchor': 'top'
    },
    xaxis=dict(rangeslider=dict(visible=True), type='category'),
    bargap=0.1,
    template='plotly_white'
)

# Save and display figure
fig2.write_html("images/interactive_yearly_incidents_barchart.html")
fig2.show()

The interactive bar chart shows:

• Years with notable spikes in security incidents
• Overall trends in global security over time
• Periods of relative stability and instability

The rangeslider at the bottom allows you to focus on specific time periods for more detailed analysis. Several factors might explain the patterns observed, including:

• Major global events and conflicts
• Changes in reporting practices
• Implementation of new security measures
• Shifts in geopolitical landscapes

4 Identifying Security Hotspots

Not all countries experience security incidents at the same rate. By identifying which nations have faced the highest numbers of incidents, we can focus attention on areas that may require additional security resources and intervention.

4.1 Countries with Most Incidents: All-Time Analysis

First, let’s look at which countries have experienced the most security incidents over the entire period covered by our dataset:

# Get total incidents by country for all time
total_by_country = df.groupby('country').size().reset_index(name='total_incidents')
total_by_country = total_by_country.sort_values('total_incidents', ascending=False)
top15_countries = total_by_country.head(8)

# Create bar chart for all-time top countries
fig_top_all_time = px.bar(
    top15_countries,
    x='country',
    y='total_incidents',
    labels={'total_incidents': 'Number of Incidents', 'country': 'Country'},
    height=450
)

# Update to use primary orange color
fig_top_all_time.update_traces(marker_color=palette["primary"])

# Configure layout
fig_top_all_time.update_layout(
    title={
        'text': 'Top Countries by Security Incidents (All Time)',
        'y': 0.95,
        'x': 0.5,
        'xanchor': 'center',
        'yanchor': 'top',
        'font': {'size': 20}
    },
    xaxis={'categoryorder': 'total descending', 'tickangle': 45}
)

# Display the figure
fig_top_all_time.show()

# Save figure
fig_top_all_time.write_html("images/top_countries_all_time.html")

This visualization highlights the countries that have historically been most affected by security incidents. Several factors might contribute to a country appearing on this list:

• Long-standing regional conflicts
• Political instability
• Higher population (which can increase the absolute number of incidents)
• More comprehensive reporting of incidents

4.2 Countries with Most Incidents: Recent Trends

Historical patterns don’t always reflect current realities. To identify emerging security hotspots, we need to focus on more recent data. The following analysis examines incident patterns over the past 10 years:

# Get incidents for the last 10 years
current_year = df['year'].max()
ten_years_ago = current_year - 10
recent_df = df[df['year'] >= ten_years_ago]

# Calculate top countries for recent period
recent_by_country = recent_df.groupby('country').size().reset_index(name='recent_incidents')
recent_by_country = recent_by_country.sort_values('recent_incidents', ascending=False)
top15_recent = recent_by_country.head(8)

# Create bar chart for recent top countries
fig_top_recent = px.bar(
    top15_recent,
    x='country',
    y='recent_incidents',
    labels={'recent_incidents': 'Number of Incidents', 'country': 'Country'},
    height=500
)

# Update to use primary orange color
fig_top_recent.update_traces(marker_color=palette["primary"])

# Configure layout
fig_top_recent.update_layout(
    title={
        'text': f'Top Countries by Security Incidents (Last 10 Years: {ten_years_ago}-{current_year})',
        'y': 0.95,
        'x': 0.5,
        'xanchor': 'center',
        'yanchor': 'top',
        'font': {'size': 20}
    },
    xaxis={'categoryorder': 'total descending', 'tickangle': 45}
)

# Display the figure
fig_top_recent.show()

# Save figure
fig_top_recent.write_html("images/top_countries_recent.html")

This recent trends analysis shows:

• Countries that have experienced deteriorating security situations in the past decade
• Nations that continue to face persistent security challenges
• Emerging hotspots that may not have appeared in historical data

By comparing this visualization with the all-time analysis, we can identify significant shifts in global security patterns.

5 Types of Injuries and Their Contexts

Understanding the nature of injuries in security incidents provides critical insights for medical preparedness and response planning. Different attack methods produce different injury patterns, each requiring specific medical interventions.

# Create a mapping between attack types and injury categories
if 'means_of_attack' in df.columns:
    # Group by attack method
    attack_counts = df['means_of_attack'].value_counts().reset_index()
    attack_counts.columns = ['Attack Type', 'Count']
    attack_counts = attack_counts.sort_values('Count', ascending=False).head(10)
    
    # Create horizontal bar chart
    fig_injuries = px.bar(
        attack_counts,
        y='Attack Type',
        x='Count',
        title='Most Common Attack Types and Associated Injuries',
        height=500,
        orientation='h'
    )
    
    # Set all bars to primary color
    fig_injuries.update_traces(marker_color=palette["primary"])
    
    # Configure layout
    fig_injuries.update_layout(
        yaxis={'categoryorder': 'total ascending'},
        xaxis_title="Number of Incidents",
        yaxis_title=None,
        title={
            'y': 0.95,
            'x': 0.5,
            'xanchor': 'center',
            'yanchor': 'top'
        }
    )
    
    fig_injuries.show()

5.1 Common Injury Types and Their Characteristics

Different attack methods produce distinct injury patterns that require specific medical responses:

5.1.1 Explosive-Related Injuries

• Blast Injuries: Primary blast injuries affect air-filled organs (lungs, ears, GI tract) through pressure waves
• Fragmentation Wounds: Secondary blast injuries from flying debris cause penetrating trauma
• Blunt Trauma: Tertiary blast injuries from being thrown by blast wind
• Burns: Quaternary blast injuries from heat and flames
• Common contexts: Suicide bombings, IEDs, landmines, aerial bombardment

5.1.2 Gunshot Wounds

• Ballistic Trauma: High-velocity projectiles create cavitation and tissue destruction
• Penetrating Wounds: Damage to vital organs, vessels, and structures
• Orthopedic Injuries: Bone fractures and joint destruction
• Common contexts: Armed conflict, targeted attacks, crossfire situations

5.1.3 Blunt Force Trauma

• Contusions and Lacerations: Soft tissue injuries
• Orthopedic Injuries: Fractures, dislocations, and crush injuries
• Internal Injuries: Damage to internal organs without external wounds
• Common contexts: Physical assaults, vehicle attacks, detention

5.1.4 Chemical/Biological Injuries

• Respiratory Damage: Pulmonary edema, airway burns
• Skin and Eye Irritation: Chemical burns, blistering
• Systemic Toxicity: Organ failure, neurological symptoms
• Common contexts: Chemical weapons deployment, industrial accidents

5.2 When Different Injury Types Occur

Certain injury patterns are more likely in specific contexts:

1. Combat/Crossfire Situations: Predominantly ballistic trauma and explosive injuries
2. Targeted Attacks: Often involve firearms or explosive devices
3. Civil Unrest: Combination of blunt trauma, less-lethal weapons effects
4. Terrorist Incidents: Complex injury patterns from explosives and multiple attack methods
5. Detention: Predominantly blunt trauma and torture-related injuries

Understanding these patterns allows for appropriate medical preparedness, including: - Proper training of medical personnel - Stockpiling appropriate medical supplies - Developing contextually appropriate evacuation protocols - Creating specialized treatment facilities in high-risk areas

6 Attack Contexts

Examining the contexts in which security incidents occur provides valuable insights for risk assessment and mitigation strategies.

# Analyze attack contexts
context_counts = df['attack_context'].value_counts().reset_index()
context_counts.columns = ['Attack Context', 'Count']

# Sort by count for better visualization
context_counts = context_counts.sort_values('Count', ascending=False)

# Create a column chart
fig_context = px.bar(
    context_counts,
    x='Attack Context',
    y='Count',
    title='Security Incidents by Attack Context',
    height=450
)

# Set primary color for all bars
fig_context.update_traces(marker_color=palette["primary"])

# Improve layout
fig_context.update_layout(
    xaxis_title=None,
    yaxis_title="Number of Incidents",
    xaxis={'categoryorder': 'total descending', 'tickangle': 45}
)

fig_context.show()

6.1 Analysis of Attack Contexts

The distribution of security incidents across different attack contexts reveals important patterns:

6.1.1 Combat/Crossfire

• Most common context for security incidents globally
• Indicates that being caught between opposing forces represents the highest risk
• Often leads to complex injury patterns and challenging evacuation scenarios

6.1.2 Individual Attacks

• Targeted violence against specific individuals or small groups
• May be politically, criminally, or personally motivated
• Requires different security approaches than combat avoidance

6.1.3 Ambushes

• Planned attacks often targeting mobile personnel
• Particularly dangerous due to the element of surprise
• Can be mitigated through route analysis and convoy procedures

6.1.4 Raids

• Organized attacks against specific facilities or compounds
• Often involve multiple attackers and coordinated tactics
• Physical security measures and response protocols are critical countermeasures

6.1.5 Detention

• Formal or informal holding of personnel by various actors
• May involve legal or extra-legal processes
• Can lead to prolonged security incidents with complex resolution requirements

This understanding of attack contexts helps security managers develop appropriate: - Training programs tailored to likely threat scenarios - Standard operating procedures for different contexts - Resource allocation based on context-specific risks - Coordination mechanisms with relevant security actors

7 Nationals vs. Internationals: Casualty Patterns

The impact of security incidents varies significantly between local nationals and international personnel. Understanding these differences is crucial for developing appropriate security protocols.

# Create data for stacked bar chart comparing nationals vs internationals
casualties_data = {
    'Category': ['Nationals', 'Internationals'],
    'Killed': [
        df['nationals_killed'].sum(),
        df['internationals_killed'].sum()
    ],
    'Wounded': [
        df['nationals_wounded'].sum(),
        df['internationals_wounded'].sum()
    ],
    'Kidnapped': [
        df['nationals_kidnapped'].sum(),
        df['internationals_kidnapped'].sum()
    ]
}

# Convert to DataFrame and reshape for stacking
casualties_df = pd.DataFrame(casualties_data)
casualties_long = pd.melt(
    casualties_df,
    id_vars=['Category'],
    value_vars=['Killed', 'Wounded', 'Kidnapped'],
    var_name='Status',
    value_name='Count'
)

# Create a stacked bar chart
fig_casualties = px.bar(
    casualties_long,
    x='Category',
    y='Count',
    color='Status',
    title='Casualties by Nationality Category (Nationals vs. Internationals)',
    barmode='stack',
    height=500,
    color_discrete_map={
        'Killed': palette["danger"], 
        'Wounded': palette["primary"], 
        'Kidnapped': palette["secondary"]
    }
)

# Improve layout
fig_casualties.update_layout(
    xaxis_title=None,
    yaxis_title="Number of People",
    legend_title_text=None,
    title={
        'y': 0.95,
        'x': 0.5,
        'xanchor': 'center',
        'yanchor': 'top'
    }
)

fig_casualties.show()

7.1 Analysis of Casualty Patterns

The comparison between nationals and internationals reveals several important patterns:

7.1.1 Disparity in Impact

• Local nationals typically suffer significantly higher casualties than international personnel
• This disparity applies across all types of harm (killed, wounded, kidnapped)
• The ratio of nationals to internationals affected often exceeds 10:1 in many contexts

7.1.2 Factors Contributing to Disparity

1. Numbers and Exposure: Locals far outnumber internationals in most areas
2. Access to Protection: Internationals often have enhanced security measures and evacuation options
3. Targeting Patterns: Some actors specifically avoid targeting internationals due to potential international consequences
4. Risk Profiles: Internationals may have more restricted movement in high-threat areas

7.1.3 Kidnapping Trends

• Kidnapping represents a relatively small proportion of overall casualties
• However, internationals face a disproportionate kidnapping risk in many contexts due to:
  • Higher perceived ransom value
  • Political leverage potential
  • Media attention

7.1.4 Implications for Security Planning

• Different security protocols may be needed for national and international staff
• Equity considerations in providing security resources
• Need for context-specific risk assessments
• Importance of inclusive security measures that protect all personnel

8 Gender Distribution of Affected Individuals

Understanding how security incidents affect different gender groups provides important insights into vulnerability patterns and protection needs.

# Check if we have gender data
gender_cols = ['gender_male', 'gender_female']

# Sum gender counts
gender_totals = {
    'Gender': ['Male', 'Female'],
    'Count': [
        df['gender_male'].sum(),
        df['gender_female'].sum()
    ]
}

# Convert to DataFrame
gender_df = pd.DataFrame(gender_totals)

# Create simple bar chart
fig_gender = px.bar(
    gender_df,
    x='Gender',
    y='Count',
    title='Gender Distribution of Affected Individuals',
    height=450
)

# Set primary color for bars
fig_gender.update_traces(marker_color=palette["primary"])

# Improve layout
fig_gender.update_layout(
    xaxis_title=None,
    yaxis_title="Number of Individuals"
)

fig_gender.show()

8.1 Analysis of Gender Patterns

The gender distribution of individuals affected by security incidents reveals several significant patterns:

8.1.1 Male Predominance

• Males constitute the majority of individuals affected by security incidents
• This pattern is consistent across different regions and incident types
• The disparity may reflect different exposure levels due to gender roles in some contexts

8.1.2 Contributing Factors

1. Occupational Exposure: Males may be overrepresented in certain high-risk professions
2. Mobility Patterns: Gender differences in freedom of movement may affect exposure to risks
3. Targeting Patterns: In some contexts, males may be specifically targeted in certain types of attacks
4. Reporting Biases: Incidents affecting females may be underreported in some settings

8.1.3 Implications for Protection

• Gender-sensitive security protocols are essential
• Protection strategies should account for different risk profiles by gender
• Gender analysis should be incorporated into security assessments
• Training should address the specific needs and vulnerabilities of different gender groups

Understanding these gender dimensions helps organizations develop more effective and inclusive security strategies that protect all personnel regardless of gender.

9 Organizations Affected by Security Incidents

Different types of organizations face varying levels of security risk based on their mandates, visibility, and operational contexts.

# Create analysis of organizational impact if we have that data
org_cols = ['un', 'ingo', 'icrc', 'nrcs_and_ifrc', 'nngo', 'other']

if all(col in df.columns for col in org_cols):
    # Create a summary of total incidents by organization type
    org_totals = df[org_cols].sum().reset_index()
    org_totals.columns = ['Organization Type', 'Total Incidents']
    
    # Better labels for organization types
    org_labels = {
        'un': 'United Nations',
        'ingo': 'International NGO',
        'icrc': 'Int. Committee of Red Cross',
        'nrcs_and_ifrc': 'National Red Cross/Red Crescent',
        'nngo': 'National NGO',
        'other': 'Other Organizations'
    }
    
    # Map the short names to full names
    org_totals['Organization'] = org_totals['Organization Type'].map(org_labels)
    
    # Sort by total incidents
    org_totals = org_totals.sort_values('Total Incidents', ascending=False)
    
    # Create a horizontal bar chart
    fig_orgs = px.bar(
        org_totals,
        y='Organization',
        x='Total Incidents',
        title='Security Incidents by Organization Type',
        height=500,
        orientation='h'
    )
    
    # Set all bars to primary color
    fig_orgs.update_traces(marker_color=palette["primary"])
    
    # Improve layout
    fig_orgs.update_layout(
        yaxis_title=None,
        xaxis_title="Number of Incidents",
        yaxis={'categoryorder': 'total ascending'},
        title={
            'y': 0.95,
            'x': 0.5,
            'xanchor': 'center',
            'yanchor': 'top'
        }
    )
    
    fig_orgs.show()

9.1 Organizational Risk Profiles

Different organizations face varying security risks based on numerous factors:

9.1.1 United Nations (UN)

• Risk Profile: High visibility, operates in conflict areas, associated with political mandates
• Common Threats: Direct targeting, collateral damage in conflict, complex attacks
• Vulnerabilities: Large footprint, political associations, high visibility
• Protective Factors: Robust security apparatus, international legal protections

9.1.2 International NGOs (INGOs)

• Risk Profile: Variable based on mandate, widespread operations in insecure environments
• Common Threats: Robbery, collateral damage, kidnapping, targeted attacks based on perceived values
• Vulnerabilities: Limited security resources compared to UN, often work in remote locations
• Protective Factors: Community acceptance, perceived neutrality (for some)

9.1.3 International Committee of the Red Cross (ICRC)

• Risk Profile: Works directly in conflict zones, protected emblem status
• Common Threats: Misidentification, deliberate targeting despite protected status
• Vulnerabilities: Proximity to conflict, access to detained persons
• Protective Factors: Protected status under IHL, recognized emblem, long history of neutrality

9.1.4 National Red Cross/Red Crescent Societies

• Risk Profile: Local presence in high-risk areas, first responders
• Common Threats: Similar to ICRC but with higher exposure due to continuous local presence
• Vulnerabilities: Less international protection than ICRC in practice
• Protective Factors: Community integration, protected emblem

9.1.5 National NGOs (NNGOs)

• Risk Profile: Deep community ties but often limited security resources
• Common Threats: Criminality, being perceived as aligned with certain factions
• Vulnerabilities: Limited evacuation options, resource constraints
• Protective Factors: Strong local knowledge, community acceptance

9.1.6 Security Implications by Organization Type

1. Organization-specific protocols: Security measures should be tailored to each organization’s unique risk profile
2. Resource allocation: Security resources should be distributed equitably based on risk
3. Coordination mechanisms: Inter-organizational security collaboration enhances protection for all
4. Training requirements: Staff need organization-specific security training

10 Comparison of Actor Types

Understanding which actors are responsible for security incidents helps identify patterns of responsibility and develop appropriate mitigation strategies.

# Filter only for Host State and Foreign actors
relevant_actors = ['Host state', 'Foreign or coalition forces']
actor_data = df[df['actor_type'].isin(relevant_actors)]

# Check if we have data for these specific actors
if len(actor_data) > 0:
    actor_counts = actor_data['actor_type'].value_counts().reset_index()
    actor_counts.columns = ['Actor Type', 'Count']
    
    # Create a column chart
    fig_actors = px.bar(
        actor_counts,
        x='Actor Type',
        y='Count',
        title='Host State vs Foreign Actors in Security Incidents',
        height=450
    )
    
    # Set primary color for all bars
    fig_actors.update_traces(marker_color=palette["primary"])
    
    # Improve layout
    fig_actors.update_layout(
        xaxis_title=None,
        yaxis_title="Number of Incidents"
    )
    
    fig_actors.show()

10.1 Analysis of Actor Responsibility

This analysis focuses specifically on two major actor types responsible for security incidents: Host State forces and Foreign/coalition forces. This comparison reveals important patterns:

10.1.1 Host State vs. Foreign Forces

• The relative frequency of incidents attributed to each actor type varies significantly by context
• Understanding these patterns helps identify which forces represent the primary security concern in different areas

10.1.2 Implications for Security Planning

1. Context-specific approaches: Security strategies should reflect the predominant actor types in each area
2. Engagement strategies: Different approaches may be needed when engaging with different security

11 Conclusion

12 Analyze individual countries

• Palestine